GHSA-9jg3-g3wh-w9pj: Path Traversal
Attack type: Unauthenticated remote
Impact: Attackers can access any system files from the underlying host.
Affected components: HttpRequestHandler.java, StaticFileHandler.java
An Unauthenticated Directory Traversal vulnerability exists in Yamcs <=5.8.6, allowing anyone to access any file on the underlying operating system. This allows unauthenticated attackers to download sensitive files and data.
<img width="2170" height="1289" alt="image" src="https://github.com/user-attachments/assets/8d426da1-5351-4240-a290-8d858be61312" />
Steps to Reproduce: 1. Start Yamcs and login as a user 2. Paste the following URL in the browser and press enter:
http://localhost:8090//etc/passwd
3. The /etc/passwd file will be downloaded.
Acknowledgements This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.yamcs:yamcs-coreto a version that resolves this vulnerability.Fixed in 5.12.0
Event History
Frequently Asked Questions
Does an attacker need a Yamcs account or other credentials?
No. The vulnerability is described as unauthenticated and requires no privileges or user interaction.
Which deployments are exposed?
Yamcs versions 5.8.6 and earlier are affected. Systems where the Yamcs service is reachable over the network are exposed to remote exploitation.
What could an attacker obtain through this issue?
An attacker can download arbitrary files from the underlying operating system, including sensitive system files and data.